Security 2026-02-22 8 min By Cornelious Fazal

How Google Uses QR Codes for Passkeys and Verification

Try the Google QR Tool Free · No signup · Permanent

Quick Answer

Google uses QR codes in more than one security flow: a phone can authorize passkey sign-in on another nearby device, and Android can compare contact keys for encrypted messages. These are not a universal replacement for every SMS two-factor code.

security/google-qr-code-2fa.html
// FAQ

Frequently Asked Questions

Not as one universal replacement. Google uses QR codes in specific passkey cross-device and message key-verification flows, while account recovery and authentication choices depend on the product, account, device, and administrator settings. Use a destination you control and review it periodically so long-lived printed material does not lead to an error.

The QR code begins a cross-device authentication flow so a passkey on your phone can authorize sign-in on another device. FIDO's design also uses Bluetooth Low Energy to verify that the devices are physically near each other. Test the complete journey on multiple phones under the lighting, distance, and network conditions expected in normal use.

It can be safe when you initiated sign-in on the displayed website and recognize the domain and device. Do not scan an authentication QR code sent unexpectedly by email, chat, a stranger, or a page whose address you have not verified.

Key verification lets trusted contacts compare cryptographic identity information for an end-to-end encrypted conversation, including through a QR workflow on supported devices. It helps detect an identity mismatch; it is not a general QR scanner or an SMS encryption feature.
Back to Knowledge Hub